cowrie
https://github.com/micheloosterhof/cowrie
Python
Cowrie SSH/Telnet Honeypot
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Python not yet supported0 Subscribers
Add a CodeTriage badge to cowrie
Help out
- Issues
- `rename()`/`mv` on a symlink moves the symlink's target instead of the symlink itself, corrupting the filesystem tree
- `Passwd.setpwentry()` reseeds the global random module using the attacker's login username, disrupting unrelated randomness in every other concurrent session
- New user's home directory is created with a garbled mode (decimal `755` used where octal `0o755` was meant)
- `CowrieServer`'s docstring says it's shared per source IP so SFTP uploads are visible in SSH sessions, but it's actually created fresh for every single connection
- `HoneyPotExecProtocol` crashes with `AttributeError` on a non-UTF-8 SSH `exec` command
- `UserDB.adduser()` crashes with `IndexError` on an empty password field, breaking every login attempt
- `virustotal` output plugin's `scanurl()` may never submit new URLs for scanning, because it doesn't accept `HTTP 404` the way `scanfile()` does
- `sqlite` output plugin uses `adbapi`'s default connection pool size, causing "database is locked" errors under concurrent load
- `jsonlog` output plugin truncates its log file on every restart when using the default (non-rotating) logtype
- `finger` command crashes with `IndexError` on a malformed `/etc/passwd` (attacker-modifiable via SFTP upload)
- Docs
- Python not yet supported